Microsoft Teams to flag malicious links hidden in QR codes

Teams will warn Defender for Office 365 users about malicious URLs found inside QR codes during an October–November 2026 rollout.

Microsoft is adding post-delivery scanning of QR codes in Microsoft Teams under Message Center notice MC1490905 for customers using Defender for Office 365. Defender extracts URLs from QR images in received messages and warns recipients when a destination is malicious; reports also say some messages can be blocked. The worldwide rollout begins in early October 2026 and is expected to finish by early November, with no extra setup, and covers internal and external conversations. Plan 1 and Plan 2 customers can use Zero-hour Auto Purge to act on eligible internal malware or high-confidence phishing after delivery. One report describes that action as blocking, while the other says ZAP can quarantine those messages. Extracted QR links will be available in Defender XDR Advanced Hunting in the MessageUrlInfo table, with UrlLocation set to QRCode.

• Microsoft Message Center notice MC1490905 adds post-delivery QR-code checks in Microsoft Teams for tenants using Defender for Office 365.
• Defender extracts web addresses from QR images in received messages and warns users when destinations are malicious; some messages can also be blocked.
• Rollout is worldwide, starts in early October 2026, and is expected to finish by early November 2026, with no extra setup.
• Warnings apply to internal and external Teams conversations.
• Defender for Office 365 Plan 1 and Plan 2 customers can use Zero-hour Auto Purge to quarantine or block eligible internal malware or high-confidence phishing after delivery.
• Extracted URLs appear in Microsoft Defender XDR Advanced Hunting in the MessageUrlInfo table, with UrlLocation set to QRCode.